Virtum

Security

Vulnerability disclosure

If you think you have found a weakness in Virtum, tell us. We would rather hear it from you than not at all. Version 2026-11-02.

What we ask

  • Report it to us first, with enough detail for us to reproduce it, and give us reasonable time to fix it before you tell anyone else.
  • Use your own accounts and test data. Do not read, change, delete or keep data that is not yours. If you reach someone else's data by accident, stop and tell us.
  • Do not degrade the service for other people.

In scope

  • The Virtum website and platform at virtum.cloud and its sub-domains
  • The Virtum device agent and relay software we publish
  • The public APIs documented for developers

Out of scope

  • Other people's systems, including systems of Virtum's customers and of its suppliers
  • Denial of service, volumetric testing and anything that degrades the service for others
  • Social engineering of our staff or customers, and physical attacks
  • Automated scanner output with no demonstrated impact
  • Reading, changing or keeping data that is not yours; stop as soon as you see it and tell us

Safe harbour

If you act in good faith and within this policy, we will treat your research as authorised, we will not take legal action against you or ask anyone else to for it, and if a third party does, we will say publicly that your work was done under this policy. This covers Virtum's own systems only. We cannot give permission on behalf of our customers or suppliers, so their systems are out of scope. This is a statement of our intent and not legal advice; it does not authorise anything the law forbids regardless of what we say.

What you can expect from us

  • We will acknowledge your report within 72 hours. Each report creates a restricted case that only our security owners can read, with a task due at that time.
  • We will keep you updated while we investigate, tell you when it is fixed, and credit you if you want it.
  • We do not run a paid bug bounty yet, so we cannot promise a reward.

Report a weakness

You can email security@virtum.cloud, or use this form. You may stay anonymous; if you leave no contact we cannot reply to you. Please do not include other people's personal data or any secret that still works.

Our security.txt lists the same contact. See also trust and security.